Skip to content
This repository has been archived by the owner on Jun 29, 2022. It is now read-only.

docs/concepts/aws.md: document TLS handshake errors in kube-apiserver #599

Merged
merged 1 commit into from
Jun 19, 2020
Merged

docs/concepts/aws.md: document TLS handshake errors in kube-apiserver #599

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/concepts/aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,3 +28,17 @@ spec:
- ipBlock:
cidr: 0.0.0.0/0
```

## TLS handshake errors in kube-apiserver logs

On the AWS platform, you may see the following logs coming from `kube-apiserver` pods:

```
I0408 05:35:02.865305 1 log.go:172] http: TLS handshake error from 127.0.0.1:45332: read tcp 127.53.210.227:7443->127.0.0.1:45332: read: connection reset by peer
I0408 05:35:12.865457 1 log.go:172] http: TLS handshake error from 127.0.0.1:45424: read tcp 127.53.210.227:7443->127.0.0.1:45424: read: connection reset by peer
I0408 05:35:22.865279 1 log.go:172] http: TLS handshake error from 127.0.0.1:45516: read tcp 127.53.210.227:7443->127.0.0.1:45516: read: connection reset by peer
```

Those logs are harmless and are caused by AWS ELBs opening TCP connections to `kube-apiserver` to probe for availability, without performing a full TLS handshake. Unfortunately, AWS ELBs do not support TLS for probe requests at the time of writing.

There is ongoing [upstream](https://github.com/kubernetes/kubernetes/pull/91277) work to resolve this issue.